{"id":"CVE-2026-108951","title":"LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check","summary":"LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH reque…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-863"],"published":"2026-10-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T13:17:27.993","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108951","references":[{"url":"https://github.com/LavaLite/cms","label":"disclosure@vulncheck.com"},{"url":"https://github.com/LavaLite/cms/issues/431","label":"disclosure@vulncheck.com"},{"url":"https://github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/Http/Request/AbstractRequest.php#L62-L70","label":"disclosure@vulncheck.com"},{"url":"https://github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/User/config/user.php#L515","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-authorization-bypass-via-user-update-api","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-10-12T14:50:34.109Z","slug":"CVE-2026-108951","body":"## Overview\n\nLavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}